这篇论文从结构层面揭示了当前LLM智能体安全方案的致命缺陷——单一护栏永远不够，做智能体部署的团队必须理解三层架构的必要性，建议所有关注AI安全的开发者仔细阅读。
这篇立场论文指出，在单一抽象层内保障LLM智能体安全不仅次优，而且根本不足——这是智能体执行方式的结构性结果，而非当前系统的偶然局限。安全运行需要三个维度：语义意图与策略合规、环境有效性、动态可行性，每个维度依赖不同阶段才可获得的不同信息集。单一护栏无法同时验证三者。论文提出基于合约的架构，每个安全维度由独立认证层强制执行，其概率保证满足下一层的假设，并通过概率链规则推导出组合系统级安全边界。三个开放问题阻碍了该架构成为可部署标准：非独立同分布轨迹的边界估计、部署漂移下的优雅降级、以及多智能体场景的扩展——这是LLM智能体运行时保障中最未完成的重要工作。
Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment
This position paper argues that enforcing LLM agent safety within a single abstraction layer is not merely suboptimal but categorically insufficient for deployed LLM agents -- a structural consequence of how agent execution works, not a contingent limitation of current systems. The three dimensions that jointly constitute safe operation -- semantic intent and policy compliance, environmental validity, and dynamical feasibility -- each depend on a strictly distinct set of information that becomes available at different stages of execution. No single guardrail can certify all three. We argue that the community must respond with a contract-based architecture in which each safety dimension is enforced by an independently certified layer whose probabilistic guarantee satisfies the next layer's assumption. We sketch such an architecture and derive the compositional system-level safety bounds it admits via the chain rule of probability. Three open problems stand between this and a deployable standard: bound estimation from non-i.i.d.\ traces, graceful degradation of contracts under deployment drift, and extension to multi-agent settings -- the most important unfinished business in LLM agent runtime assurance.